Domain needs to be eagerly validated

[annevk]

Colleagues discovered that Chromium rejects when attempting to set a cookie for a public suffix domain, rather than letting "receives a cookie" take care of that (which would result in resolving).

We will match that behavior as it's better for web developers.

But this needs to be defined.

cc @RupinMittal @bakulf